Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

This question is related with copyrights. The copyright is granted by default to the author of some code, however this requires to prove that some person is the "first" author of some piece of code. Consider the following example:

  • Andy writes some code in 2010 and stores it in a not secure enough place.
  • Brian copies that code in 2011 and registers this code in some service to associate it with some timestamp, to prove he had it written in 2011.
  • Andy decides he should be able to prove he is the author of the yet not published code and gets proceeds as Brian in 2012.
  • Carol has to judge who is the original author of that code in 2013 and all the evidence is in favor of Brian.

I think such a service is important and if I'm not mistaken there are some services like that which provide this for a price. At the same time nowadays there are quite a few git based services like Github, Bitbucket, Assembla, etc. that provide a version control system and store all the different versions made available for some code through time. They are free and offer really nice features. In some of them it is possible to define a repository as private and then switch it as public when the code is ready to be released.

The problem with the git based services is that they trust and believe the client on the dates for the commits. This means that if Brian commits in 2011 some code and publishes (pushes) it then David could manipulate the date in his computer to pretend he committed that code in 2009, beating Brian and Andy (the real author of the code).

So basically I would like to know if there is some kind of service like these that:

  • handles timestamps in a trustworthy way
  • allows publishing the code
  • allows publishing the different versions and diffs
  • allows private repositories that can be made public if shit happens
  • is free

So far, the most reasonable approach I found is sending something through mail. Even though the MIME headers can be manipulated the SMTP servers in the route should not be reasonably trustworthy and they set the timestamp for the time the mail goes through them.

This is a whole mess when compared with bitbucket, for instance, you cannot read my e-mails (I truly hope). Bitbucket allows private repos, repos can be made public with all the previous versions and diffs, etc. The only problem: the timestamps an be manipulated and thus they are not trustworthy.

So the question is: do you know about any service like this?

PD: Emails should be as valid as regular mail or escrows, even though they may raise more eyebrows among lawyers. But even if a tarball in an email is something simple to produce and do, it's much more natural to simply use some CVS, which should be used anyway. They do even have the timestamps already and I guess that should work in centralized systems like subversion, where the timestamp is set by the server. So maybe services that allow subversion repositories (SourceForge, Assembla, Google Code, etc.) could be enough? Would they be enough? Do you know about other (possibly better) alternatives? Assembla seems to be the only one fulfilling all the requisites.

Thank you.

share|improve this question

put on hold as off-topic by gnat, MichaelT, GlenH7, Bart van Ingen Schenau, jwenting Oct 16 at 13:17

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to recommend a tool, library or favorite off-site resource are off-topic for Programmers as they tend to attract opinionated answers and spam. Instead, describe the problem and what has been done so far to solve it." – gnat, MichaelT, GlenH7, Bart van Ingen Schenau, jwenting
If this question can be reworded to fit the rules in the help center, please edit the question.

1  
I believe the official term for what you're describing is Trusted Timestamping. Googling around for "trusted timestamp service" can net you a few. I'll post an answer for at one service I'm familiar with... –  MidnightLightning Apr 24 '13 at 14:28
    
Yes, to some extent I'm searching for some CVS hosting with trusted timestamping, at least to the level of trust that one can put on the servers in a trace of e-mails, wikipedia servers, stackexchange servers or a SVN server run by some "trusted" third party. Hacking these servers is probably possible but not truly feasible, I think (I may be wrong) this may be legally a solid enough proof. –  Trylks Apr 24 '13 at 15:42
    
In the USA, the Copyright Office will allow you to register your copyright by depositing a copy of the work with them. US (and maybe Berne Convention?) law attaches stiffer penalties to violating a registered copyright. –  Ross Patterson Apr 24 '13 at 22:12

2 Answers 2

The Bitcoin cryptocurrency can provide this service as a side effect of the currency bookkeeping method (the blockchain; a P2P shared ledger that's cryptographically signed).

Take a hash of your code at a given point in time (use some sort of version-control software to ensure you can get back to that point), and use a utility like BitcoinTimestamp to embed that hash in the blockchain (which automatically gives it a timestamp).

The popular Bitcoin dice game SatoshiDice uses that method to publicly verify that it hasn't changed its secret numbers since the time the hash was calculated.

This service can keep that timestamp around as long as some P2P node continues to broadcast the blockchain files. If the cryptocurrency fails, the P2P network may dissolve and you'd lose the ability to verify your timestamp, but that's true of any escrow service, and this system at least doesn't have a single point of failure (being a P2P network).

share|improve this answer
    
That is impressive, I guess I may simply add a "timestamps" file that is included in the commits and which should include (in each commit) a new timestamp produced with the service you mention, with a reasonable cost. I tried to stress the CVS capabilities over the trust, though. For instance I can prove I didn't edit this question more than once to add the PD, it's not as trusted as bitcoins, but it's reasonable to assume I didn't hack SE to do that. The point is: the timestamp is set in SE (as in Assembla), not in my computer (which is the case for GIT). –  Trylks Apr 24 '13 at 15:31
    
Adding to the previous comments, there is now a webpage called Proof of Existence, that provides this kind of service. However it would still be cool to have it somehow (maybe not so trustworthily) integrated in a VCS that allows publishing the code (as GitHub)... –  Trylks Jun 23 at 11:57

There are escrow services, you can put your code in escrow for a fee. I'm not a lawyer, but I guess that would be enough to prove copyright? The other option is the standard Post Office copyright, put your code on a usb stick, in a tamperproof envelope, and mail it to yourself. Then when question of copyright comes up, you have your code available to you.

share|improve this answer
    
Added a postdata. I think Assembla may actually work for this when creating subversion repositories. I think it should be enough in legal terms. I couldn't find another service that provides the same functionality yet, so it seems to be the only one and thus the best one. Any correction to what I believe to be true is welcome. –  Trylks Apr 24 '13 at 13:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.